{"record":{"id":"fd9755dc378b5168","repo":"juicedata/juicefs","slug":"w-please-set-the-jfs-rsa-passphrase-environmen","errorCode":null,"errorMessage":"%w: please set the 'JFS_RSA_PASSPHRASE' environment variable","messagePattern":"%w: please set the 'JFS_RSA_PASSPHRASE' environment variable","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/format.go","lineNumber":293,"sourceCode":"\t\t\tobject.GetHttpClient().Transport.(*http.Transport).TLSClientConfig.Certificates = []tls.Certificate{clientTLSCert}\n\t\t}\n\t}\n\n\tif format.Shards > 1 {\n\t\tblob, err = object.NewSharded(strings.ToLower(format.Storage), format.Bucket, format.AccessKey, format.SecretKey, format.SessionToken, format.Shards)\n\t} else {\n\t\tblob, err = object.CreateStorage(strings.ToLower(format.Storage), format.Bucket, format.AccessKey, format.SecretKey, format.SessionToken)\n\t}\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tblob = object.WithPrefix(blob, format.Name+\"/\")\n\tinitStorageTiers(blob, format.Tiers)\n\tif format.EncryptKey != \"\" {\n\t\tprivKey, err := object.ParsePrivateKeyFromPem([]byte(format.EncryptKey), []byte(os.Getenv(\"JFS_RSA_PASSPHRASE\")))\n\t\tif err != nil {\n\t\t\tif errors.Is(err, object.ErrKeyNeedPasswd) {\n\t\t\t\treturn nil, fmt.Errorf(\"%w: please set the 'JFS_RSA_PASSPHRASE' environment variable\", err)\n\t\t\t}\n\t\t\treturn nil, fmt.Errorf(\"parse private key: %s\", err)\n\t\t}\n\t\tencryptor, err := object.NewDataEncryptor(object.NewKeyEncryptor(privKey), format.EncryptAlgo)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tblob = object.NewEncrypted(blob, encryptor)\n\t}\n\treturn blob, nil\n}\n\nfunc initStorageTiers(storage object.ObjectStorage, tiers object.Tiers) {\n\tif tierStorage, ok := storage.(object.SupportTier); ok {\n\t\tif err := tierStorage.InitTiers(tiers); err != nil && hasConfiguredTiers(tiers) {\n\t\t\tlogger.Warnf(\"Set storage tier: %s\", err)\n\t\t}\n\t}","sourceCodeStart":275,"sourceCodeEnd":311,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/cmd/format.go#L275-L311","documentation":"The configured encryption key is a passphrase-protected RSA private key, and no passphrase was supplied. ParsePrivateKeyFromPem returned ErrKeyNeedPasswd, which createStorage wraps with instructions to set the JFS_RSA_PASSPHRASE environment variable.","triggerScenarios":"`juicefs format` with an --encrypt-key file generated via `openssl genrsa -aes...` (or ssh-keygen with a passphrase) while the JFS_RSA_PASSPHRASE environment variable is unset or empty.","commonSituations":"Encrypt-at-rest volumes set up interactively on one machine then used from CI/containers where the env var was never exported; passphrase rotated but env var stale; systemd units missing Environment= line.","solutions":["Export the variable before running: `export JFS_RSA_PASSPHRASE='your-passphrase'` then re-run the command","Generate a passphrase-free key if acceptable: `openssl rsa -in key.pem -out key-nocrypt.pem`","Pass the env var inline: `JFS_RSA_PASSPHRASE='...' juicefs format ...`","For services, add `Environment=JFS_RSA_PASSPHRASE=...` or use an EnvironmentFile/secret manager"],"exampleFix":"// before\njuicefs format --encrypt-key key.pem ...\n// after\nexport JFS_RSA_PASSPHRASE='secret'\njuicefs format --encrypt-key key.pem ...","handlingStrategy":"validation","validationCode":"if os.Getenv(\"JFS_RSA_PASSPHRASE\") == \"\" {\n    if keyData, _ := os.ReadFile(keyPath); strings.Contains(string(keyData), \"ENCRYPTED\") {\n        return fmt.Errorf(\"key %s is encrypted; set JFS_RSA_PASSPHRASE\", keyPath)\n    }\n}","typeGuard":"func keyNeedsPassphrase(pemBytes []byte) bool {\n    return strings.Contains(string(pemBytes), \"ENCRYPTED\") ||\n        strings.Contains(string(pemBytes), \"Proc-Type: 4,ENCRYPTED\")\n}","tryCatchPattern":"_, err := createStorage(...)\nif err != nil && errors.Is(err, object.ErrKeyNeedPassphrase) {\n    // prompt for or load JFS_RSA_PASSPHRASE and retry\n}","preventionTips":["Generate encryption keys without a passphrase when used non-interactively","Export JFS_RSA_PASSPHRASE in CI/containers via secret injection","Verify with `openssl rsa -in key.pem -check -noout` (fails without the right passphrase if encrypted)"],"tags":["encryption","rsa","environment"],"backgroundTag":"missing-env-var","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}